russell@unturf.com
0a580b313d
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com Patches, unit tests, benchmarks, whitepaper, and outreach briefs. Public domain — no copyright claimed. Use freely.
39 lines
1.3 KiB
ReStructuredText
39 lines
1.3 KiB
ReStructuredText
ExaBGP — CWE-407 Analysis
|
|
==========================
|
|
|
|
.. contents:: :local:
|
|
|
|
Overview
|
|
--------
|
|
|
|
ExaBGP is a Python-based BGP implementation primarily used for BGP traffic engineering,
|
|
route injection, and network monitoring. It is used in production by large networks for
|
|
anycast management and DDoS mitigation.
|
|
|
|
Status: **CLEAN** (scanned 2026-03-23)
|
|
---------------------------------------
|
|
|
|
Scan returned 22 candidates. All triaged as false positives.
|
|
|
|
Triage Notes
|
|
------------
|
|
|
|
The 22 candidates fell into three categories:
|
|
|
|
1. **``dict`` index operations** — Python ``dict`` key lookup is O(1). Patterns like
|
|
``x in some_dict`` matched the scanner's ``in (path|stack|visited)`` keyword filter but
|
|
the container is always a ``dict``, not a ``list``.
|
|
|
|
2. **OS path operations** — ``os.path`` calls containing the word ``path`` matched the
|
|
keyword filter but are file-system operations unrelated to graph traversal.
|
|
|
|
3. **String methods** — ``str.find()`` and string ``in`` operator in protocol message
|
|
parsing. Not membership in a visited-node set.
|
|
|
|
BGP AS-path loop detection uses ``as_path.as_set`` (a Python ``set``) for loop checking:
|
|
O(1). The RIB uses ``dict``-backed route stores throughout. No list-backed visited sets found.
|
|
|
|
References
|
|
----------
|
|
|
|
* Scan result: ``tools/scan-results/exabgp.txt``
|